6.4.2 SRP

The initialization functions in SRP credentials differ between client and server. Clients supporting SRP should set the username and password prior to connection, to the credentials structure. Alternatively gnutls_srp_set_client_credentials_function may be used instead, to specify a callback function that should return the SRP username and password. The callback is called once during the TLS handshake.

int gnutls_srp_allocate_server_credentials (gnutls_srp_server_credentials_t * sc)

int gnutls_srp_allocate_client_credentials (gnutls_srp_client_credentials_t * sc)

void gnutls_srp_free_server_credentials (gnutls_srp_server_credentials_t sc)

void gnutls_srp_free_client_credentials (gnutls_srp_client_credentials_t sc)

int gnutls_srp_set_client_credentials (gnutls_srp_client_credentials_t res, const char * username, const char * password)

Function: void gnutls_srp_set_client_credentials_function (gnutls_srp_client_credentials_t cred, gnutls_srp_client_credentials_function * func)

cred: is a gnutls_srp_server_credentials_t structure.

func: is the callback function

This function can be used to set a callback to retrieve the username and password for client SRP authentication. The callback’s function form is:

int (*callback)(gnutls_session_t, char** username, char**password);

The username and password must be allocated using gnutls_malloc() . username and password should be ASCII strings or UTF-8 strings prepared using the "SASLprep" profile of "stringprep".

The callback function will be called once per handshake before the initial hello message is sent.

The callback should not return a negative error code the second time called, since the handshake procedure will be aborted.

The callback function should return 0 on success. -1 indicates an error.

In server side the default behavior of GnuTLS is to read the usernames and SRP verifiers from password files. These password file format is compatible the with the Stanford srp libraries format. If a different password file format is to be used, then gnutls_srp_set_server_credentials_function should be called, to set an appropriate callback.

Function: int gnutls_srp_set_server_credentials_file (gnutls_srp_server_credentials_t res, const char * password_file, const char * password_conf_file)

res: is a gnutls_srp_server_credentials_t structure.

password_file: is the SRP password file (tpasswd)

password_conf_file: is the SRP password conf file (tpasswd.conf)

This function sets the password files, in a gnutls_srp_server_credentials_t structure. Those password files hold usernames and verifiers and will be used for SRP authentication.

Returns: On success, GNUTLS_E_SUCCESS (0) is returned, or an error code.

Function: void gnutls_srp_set_server_credentials_function (gnutls_srp_server_credentials_t cred, gnutls_srp_server_credentials_function * func)

cred: is a gnutls_srp_server_credentials_t structure.

func: is the callback function

This function can be used to set a callback to retrieve the user’s SRP credentials. The callback’s function form is:

int (*callback)(gnutls_session_t, const char* username, gnutls_datum_t* salt, gnutls_datum_t *verifier, gnutls_datum_t* g, gnutls_datum_t* n);

username contains the actual username. The salt , verifier , generator and prime must be filled in using the gnutls_malloc() . For convenience prime and generator may also be one of the static parameters defined in gnutls.h.

In case the callback returned a negative number then gnutls will assume that the username does not exist.

In order to prevent attackers from guessing valid usernames, if a user does not exist, g and n values should be filled in using a random user’s parameters. In that case the callback must return the special value (1).

The callback function will only be called once per handshake. The callback function should return 0 on success, while -1 indicates an error.